# does bro-ids support parsing QUIC?

**URL:** <https://community.zeek.org/t/does-bro-ids-support-parsing-quic/4582>\
**Category:** Zeek\
**Created:** [January 7, 2017, 3:47am UTC](https://community.zeek.org/t/does-bro-ids-support-parsing-quic/4582 "2017-01-07T03:47:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jason\_Haar](https://avatars.discourse-cdn.com/v4/letter/j/ac8455/32.png) [@Jason\_Haar](https://community.zeek.org/u/Jason_Haar)\
**Post date:** [January 7, 2017, 3:47am UTC](https://community.zeek.org/t/does-bro-ids-support-parsing-quic/4582/1 "2017-01-07T03:47:42Z")

</div>

Hey there

I’m using the ssl.log files to augment our proxy logs (we have transparent proxy on port 80, but I believe TLS intercept has no future, so I’m using bro-ids to capture tcp/443 SNI data - as it’s better than doing nothing)

Works well - but I don’t think QUIC is supported? Any chance of that being supported - same outcome as HTTPS: just after the SNI data…

FYI: QUIC is basically HTTP/2 over UDP

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [January 7, 2017, 6:57am UTC](https://community.zeek.org/t/does-bro-ids-support-parsing-quic/4582/2 "2017-01-07T06:57:50Z")

</div>

Hello Jason,

> I'm using the ssl.log files to augment our proxy logs (we have transparent  
> proxy on port 80, but I believe TLS intercept has no future, so I'm using  
> bro-ids to capture tcp/443 SNI data - as it's better than doing nothing)
> 
> Works well - but I don't think QUIC is supported? Any chance of that being  
> supported - same outcome as HTTPS: just after the SNI data...

No, it is not supported. There is a chance of it being supported, but if that happens it is likely not going to happen in the very near term (I looked into it a bit ago and would like to add it, but I am quite a bit short of time at the moment).

> FYI: QUIC is basically HTTP/2 over UDP

While that certainly is true from an outcome point of view, it sadly is not quite true from a protocol point of view (HTTP/2 is just TLS, QUIC does its own thing everywhere, including having special compression for cleartext stuff if I remember it correctly - that is a bit of work...).

Johanna

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [January 7, 2017, 12:25pm UTC](https://community.zeek.org/t/does-bro-ids-support-parsing-quic/4582/3 "2017-01-07T12:25:39Z")

</div>

You can use protosigs ([https://github.com/broala/bro-protosigs](https://github.com/broala/bro-protosigs)) to catch QUIC:

signature protosig\_ssl\_udpquic {  
ip-proto == udp  
dst-port ==443  
payload /.\*\x51\x30\x33/  
eval ProtoSig::match  
}

signature protosig\_ssl\_tcpquic {  
ip-proto == tcp  
dst-port ==443  
payload /\x31\x51\x54\x56/  
eval ProtoSig::match  
}

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/does-bro-ids-support-parsing-quic/4582/4 "2022-05-06T15:44:28Z")

</div>